|  | 6.3 | Standard ACLs
| 6.3.6 |
Writing a standard ACL to deny a specific subnet

The example shows how an ACL is designed to block traffic from a specific subnet, 172.16.4.0, and to allow all other traffic to be forwarded. Note the wildcard mask, 0.0.0.255: The zeros in the first three octets indicate that those bits will be tested for matches while the last octet of all ones indicates a don't care condition for matching the last octet of the IP address (the host portion). Note also that the any abbreviation has been used for the IP address of the source. Denying a Specific Subnet (access-list 1 deny) 172.16.4.0 0.0.0.255 access-list 1 permit any (implicit deny any) (access-list 1 deny any) interface ethernet 0 ip access-group 1 out
| Interactive Lab Activity (Flash, 514 kB)
| Before trying the actual lab, you may want to try out this activity to test yourself on the proper command syntax for Standard Access Control Lists (ACLs).

| Lab Activity
| In this lab you will work with Standard Access Control Lists (ACLs) to regulate the traffic that is allowed to pass through a router based on the source, either a specific host (typically a workstation or server) or an entire network (any host or server on that network).